Read the docs
TI-2024-35310 Aliases CVE-2024-52797GHSA-jh6x-7xfg-9cq2

Searching Opencast may cause a denial of service

Priority LOW 35CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's Elasticsearch integration may generate syntactically invalid Elasticsearch queries in relation to previously acceptable search queries. From Opencast version 11.4 and newer, Elasticsearch queries are retried a configurable number of times in the case of error to handle temporary losses of connection to Elasticsearch. These invalid queries would fail, causing the retry mechanism to begin requerying with the same syntactically invalid query immediately, in an infinite loop. This causes a massive increase in log size which can in some cases cause a denial of service due to disk exhaustion. Opencast 13.10 and Opencast 14.3 contain patches which address the base issue, with Opencast 16.7 containing changes which harmonize the search behaviour between the admin UI and external API. Users are strongly recommended to upgrade as soon as possible if running versions prior to 13.10 or 14.3. While the relevant endpoints require (by default) `ROLE_ADMIN` or `ROLE_API_SERIES_VIEW`, the problem queries are otherwise innocuous. This issue could be easily triggered by normal administrative work on an affected Opencast system. Those who run a version newer than 13.10 and 14.3 and see different results when searching in their admin UI vs your external API or LMS, may resolve the issue by upgrading to 16.7. No known workarounds for the vulnerability are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00922 60th percentileScored 2026-11-07
Fix Fixed opencast (opencast): 13.10, 14.3, 16.7org.opencastproject:opencast-elasticsearch-impl (Maven): 13.10, 14.3, 16.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opencastopencast11.4 to before 13.10; 14.0 to before 14.3; 15.0 to before 16.713.10, 14.3, 16.7Patch availableCNA
—org.opencastproject:opencast-elasticsearch-impl (Maven)11.4 to before 13.1013.10Patch availableGHSA-jh6x-7xfg-9cq2
—org.opencastproject:opencast-elasticsearch-impl (Maven)14.0 to before 14.314.3Patch availableGHSA-jh6x-7xfg-9cq2
—org.opencastproject:opencast-elasticsearch-impl (Maven)15.0 to before 16.716.7Patch availableGHSA-jh6x-7xfg-9cq2
  • opencast Vendoropencast Affected 11.4 to before 13.10; 14.0 to before 14.3; 15.0 to before 16.7 Fixed in 13.10, 14.3, 16.7 Patch available CNA
  • org.opencastproject:opencast-elasticsearch-impl (Maven) Vendor— Affected 11.4 to before 13.10 Fixed in 13.10 Patch available GHSA-jh6x-7xfg-9cq2
  • org.opencastproject:opencast-elasticsearch-impl (Maven) Vendor— Affected 14.0 to before 14.3 Fixed in 14.3 Patch available GHSA-jh6x-7xfg-9cq2
  • org.opencastproject:opencast-elasticsearch-impl (Maven) Vendor— Affected 15.0 to before 16.7 Fixed in 16.7 Patch available GHSA-jh6x-7xfg-9cq2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*11.4 to before 13.10; 14.0 to before 14.3; 15.0 to before 16.7VulnerableApereo
  • cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions 11.4 to before 13.10; 14.0 to before 14.3; 15.0 to before 16.7 Vulnerable ·Apereo

Remediation

  • Fix · CNA opencast (opencast) Fixed in 13.10, 14.3, 16.7
  • Fix · GHSA-jh6x-7xfg-9cq2 org.opencastproject:opencast-elasticsearch-impl (Maven) Fixed in 13.10 Advisory →
  • Fix · GHSA-jh6x-7xfg-9cq2 org.opencastproject:opencast-elasticsearch-impl (Maven) Fixed in 14.3 Advisory →
  • Fix · GHSA-jh6x-7xfg-9cq2 org.opencastproject:opencast-elasticsearch-impl (Maven) Fixed in 16.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52797
  2. 2026-10-03 Alias added: GHSA-jh6x-7xfg-9cq2

References

Patch 2

Advisory 2

Other 3

  • TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
  • TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
  • TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
  • TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
  • TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
  • TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences